Check that the viewer can actually create badges before letting them create badges

Summary: Fixes T9467.

Test Plan: Set policy to "no one", got blocked.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T9467

Differential Revision: https://secure.phabricator.com/D14159

src/applications/badges/controller/PhabricatorBadgesEditController.php

@@ -22,6 +22,9 @@ final class PhabricatorBadgesEditController
       }
       $is_new = false;
     } else {
+      $this->requireApplicationCapability(
+        PhabricatorBadgesCreateCapability::CAPABILITY);
+
       $badge = PhabricatorBadgesBadge::initializeNewBadge($viewer);
       $is_new = true;
     }